lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Sep 2014 15:37:49 -0700
From: epixoip <epixoip@...dshell.nl>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] omegacrypt and timing

On 9/17/2014 3:18 PM, Krisztián Pintér wrote:
> epixoip (at Wednesday, September 17, 2014, 11:57:08 PM):
>> Then you do not seem to understand what Threat Modeling is.
> a model not chosen in accordance with physical reality is worthless.
> if your modeling excludes side channel attacks for whatever reason,
> when those are in fact feasible, your model is not a good model of
> reality, and your data will be compromised. do you disagree with this?

Again, you don't seem to understand how Threat Modeling works. No
threats are excluded from the threat model, but the access vector,
complexity, probability, and impact are all a factor in determing
whether a threat actually poses significant risk. Threats that do not
pose any significant or measurable risk are largely inconsequential.

The most significant threat to password hashing as evidenced by decades
of password database breaches is offline cracking. That is the primary
threat that poses the most risk, and compared to the other threats, the
only one that really matters.




Powered by blists - more mailing lists